The gold standard for x402 resources. 571 curated entries — paid endpoints probed for a live 402 before listing, libraries and repos checked for real activity, and the whole shelf re-knocked every night with the result dated. No filler.
The big catalogs list everything ever submitted — that's their job, and it's why most of what's in them is dead. We measured it: 67–79% of the free-listing catalogs no longer answer.
gold-402 is the other thing. Smaller on purpose. A person checked every entry, we publish what we checked and what we didn't, and in July 2026 we started buying services and reporting what came back. Automated monitors now do the machine half of that continuously and do it well; what they do not do — by their own published scope — is judge whether the thing that came back was any good. That judgement is what this list is.
The product. 571 entries across 13 shelves, in directory/.
| Shelf | What's on it |
|---|---|
| APIs & Services | Paid endpoints an agent can call. Every one probed for a live 402 before listing. |
| MCP Servers | Model Context Protocol servers — utility, crypto, security, identity, escrow, discovery. |
| SDKs & Libraries | Client and server libraries across languages. |
| Facilitators | Payment verification and settlement services. |
| Frameworks | Agent frameworks with x402 support. |
| Tools | CLIs, CI, monitoring, spend controls, testing, discovery. |
| Security | Audit, risk scoring, pre-execution gates, compliance. |
| Ecosystem | Protocol, infrastructure, wallets, orchestration, marketplaces. |
| Aggregators & Proxies | One integration, many upstreams — services that unify or resell access to other providers' APIs and data. |
| The Global Agent Economy | China, India, Korea — infrastructure no English-language directory indexes. |
| Learning | Quickstarts, tutorials, reference docs, news. |
| Community | Channels, newsletters, jobs, events. |
| Market Data | On-chain analytics, dashboards, adoption. |
There is no stamp. There was one — "Gold402 Verified," one tier, a gold tick — and it was retired on 2026-09-06 because it said the identical thing about a paid API we knocked last Tuesday, a community wiki with no endpoint to knock at all, and an entry we hold no dated receipt for. A mark that everything wears certifies nothing. We have made that criticism of other people's badges and it was true of ours.
What every entry now carries instead is the finding, per entry:
- A date — this endpoint answered an HTTP 402 when we knocked it, on this day. An automated gate checks the submission, a maintainer confirms it before merge, and a sweep re-knocks and writes a dated result. A date is checkable. A tick is not.
- Or "listed — no knock receipt" — a human read it and it is on the list. We hold no dated knock, and we will not backfill a date we cannot show.
- Or "listed — no endpoint to knock" — libraries, guides, wallets, clients and community resources. Nothing here answers a 402 because that is not what these things do. We read them, and we checked they were publicly reachable.
None of it is a delivery test. We have not paid these services and graded what came back. Read any of it as "we checked what is stated above," never as "this is worth the money."
Some entries carry more. Where we have paid for a service and confirmed what came back, we say so and keep the receipt — what we sent, what it cost, the transaction hash, what arrived. That is a stronger claim and we only make it about services we actually bought. Most of the list has not been through that, and we would rather say so than imply otherwise.
Numbers we measured ourselves, each with its date, sample size and method. Where measurements disagree, both are shown — they were taken on different days by different methods, and blending them into one tidy figure would be the kind of thing this directory exists to argue against.
| Measured | Population | Live | Dead | Method |
|---|---|---|---|---|
| 2026-07 | 22,545 CDP Bazaar services | 5,792 | 74% | full probe crawl, valid 402 required |
| 2026-07-10 | 25,614 catalog services | 5,344 | 79% | catalog snapshot, verify-state carried forward |
| 2026-07-29 | 24,583 catalog services | — | ~67% | earlier full crawl, cited in the liveness study |
Three runs, three numbers, one direction: the large free-listing catalogs are majority dead, and have been all month. Anyone quoting a single decimal-point figure for this is quoting a moment, not a fact.
Across four independent registries — 204,500 registered agents and services — the dead share tracks one variable: what it costs to get listed.
| Registry | Entry cost | Dead |
|---|---|---|
| CDP Bazaar | free | ~67–79% |
| ERC-8004 on-chain identity | gas only | 85–97% |
| Glama MCP registry | curation + scoring | 47% unhealthy (their own published figure) |
Free entry selects for abandonment. Full method, limits, and an open invitation to refute it: The Liveness Law →
In July 2026 we ran a paid delivery check across our own shelf — actually buying services and recording what came back.
- 16 of 126 listed services were purchasable by a machine at a discoverable address
- 8 delivered exactly what they advertised
- 0 took payment and returned nothing
- $0.054 spent, every transaction reconciled on-chain
The friction in this economy sits before the payment, not after it. Most services are fine; most front doors are not. We are not claiming that as a finding yet — the sample is 16 services and one day, 2026-07-30. A wider census was designed the same week and has not run; the blocker is ours, not the ecosystem's. We would rather say that than let the sentence stand.
x402 is a US-governed rail. It is not the only answer to machine payment, and outside the West it is not the answer being used — China runs delegated agent authorization on existing rails, India runs regulated human-signed mandates that agents execute inside a cap. Both were operating at scale before the x402 Foundation was a month old.
We index that world too, including surfaces no English-language directory carries: The Global Agent Economy →
All figures above are ours and reproducible. Where we could not reach something, we say so rather than leaving the gap invisible.
September 2026 — one pick per shelf. Each shelf opens with its pick and the write-up. Selection is the maintainers' judgment: well-built, actively used, worth a second look. A shelf with no pick that clears the bar runs empty — the empty slot is also a verdict.
| Shelf | September pick |
|---|---|
| APIs & Services | Forge Attestation |
| MCP Servers | Council of AI GSPC MCP |
| SDKs & Libraries | x402-rs |
| Facilitators | NEAR x402 Facilitator |
| Frameworks | @moltrust/x402 |
| Tools | nohumans.directory |
| Security | MIDAX402 |
| Ecosystem | Skyfire |
| The Global Agent Economy | Alipay Open Platform |
| Learning | The Agent Times |
| Community | Human Pages |
| Market Data | MCP Scores |
| Aggregators & Proxies | 402Signal |
The wire lives at 24klabs.ai/news — dated editions with permanent links, every claim cited. Four editions so far; the most recent is 2026-08-10. It is not on a schedule.
This week (Sep 21—27)
- eu-validate — Validates IBAN (mod-97 offline), EU VAT number (VIES), and company domain (DNS/MX) in one x402 call. $0.01 USDC on Base mainnet. Built by Forge, an AI-owned company. Example:
POST /v1/validate {"iban":"NL91ABNA0417164300","vat_number":"NL123456782B01","domain":"example.com"}. (GitHub) - Solana Wallet Research — Returns bounded finalized public-data reports for Solana wallet addresses for $0.01 USDC per call on Solana mainnet via x402.
- HydraTrader x402 Catalog — Three pay-per-call Base USDC helpers via x402 (no API key):
POST /v1/cheap-errand($0.01) summarize/rewrite/classify/keywords/sentiment/translate;POST /v1/structured-extract($0.03) schema-bound extract from pasted text or public URLs;POST /v1/research-brief($0.08) short public-web briefs with citations (fair-use snippets only). (SKILL | OpenAPI | llms.txt) - Agent Bazaar — Open, permissionless x402 discovery marketplace mirroring Coinbase's CDP Bazaar catalog (15,000+ resources) plus independently-submitted listings, with an MCP server and A2A agent registry, no account required to list or read.
- SignalHarness.ai — Publishes 330 production x402 API services for AI agents covering web and data processing, validation, AI utilities, and blockchain and crypto utilities.
- 100pro Token Contract Risk Screen — Pre-trade risk screen for EVM (Base) and Solana token contracts: honeypot, clone/mimic and owner-privilege signals returned with the evidence behind each flag, $0.05 USDC per call on Base. The report is served only after the USDC settlement is verified on Base, so a caller is never charged for a screening that did not settle. Example:
GET /screen?token=0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913&chain=base. (OpenAPI, llms.txt) - Brian Booms x402 Store — 33 digital products (music licenses, podcast packs, sample packs, custom commissions, wallpapers) sold via x402 micropayments in USDC on Base, Polygon, Arbitrum, Avalanche, and Solana, priced $0.05–$999 with instant download delivery. (Catalog)
- webcap — Web capture API with seven pay-per-call routes: page screenshots, structured content extraction, SEO audits, site mapping, scroll-capture video, and AI visual analysis, $0.001-$0.01 USDC on Base via x402 with no API keys. Example:
POST /v1/x402/capture {"url":"https://example.com"}. - Crypto Sentiment API — Real-time crypto sentiment for any ticker, aggregating 8 crypto news outlets and the Fear & Greed Index into a bullish/bearish/neutral score. $0.01 USDC on Base, no API key.
- PayPerByte — Twelve pay-per-call USDC data feeds and oracles on Base mainnet: weather, earthquakes, CCTP v2 attestation-latency distributions, security advisories (CVE + CISA KEV), runtime end-of-life dates, malicious-package verdicts, perp positioning, and Know-Your-Agent sanctions/counterparty/merchant-screening and reasoning-verdict oracles; $0.003–$0.10 USDC per call, each response signed with an EIP-712 PayloadAttestation over the exact bytes served. Example:
POST /feeds/address-reputation {"domain":"example.com","address":"0x1111111111111111111111111111111111111111","amount":50000,"chain":"base"}. (GitHub) (Manifest) - Clarity — Base mainnet x402 gateway for external USDC payers: OpenAI-compatible chat ($0.001) and short research/verdict reports ($2) via local Ollama. No API keys. Example:
POST /v1/x402/report {"topic":"x402 agent commerce on Base","max_words":400}. (OpenAPI) (Buy) (Buyer walkthrough) - Vend API Merchant — Pay-per-call web intelligence settled in Nano (XNO), the feeless rail: URL-to-Markdown extraction, link check (status/redirect/time), domain intelligence (WHOIS/DNS/headers), web search, IP geolocation, nano-account info, YouTube transcripts, PDF text extraction, screenshot, browser render, CSS-selector extraction, page metadata, HTML table extraction, AI-jobs search, wiki summary, arXiv paper, HN feed, address verdict, and x402-lint (live-verify any x402 listing). 22+ live endpoints answer a valid x402 v2 402 challenge on
nano:mainnet, 0.0001–0.0005 XNO per call (≈<$0.01), no signup, no API keys, error responses not billed. (Manifest) (Docs) (OpenAPI) (llms.txt) - Gateway Website Quick Check — Returns an asynchronous one-page website metadata report for $0.05 USDC on Base via x402, with private status and result retrieval.
Last week (Sep 14—20)
- url2md — PDFs and x402-tolled pages, returned as clean Markdown. When the target page answers 402 with x402 terms, url2md pays that toll for the caller, quoted at the toll plus 25% and capped at $0.05. JavaScript-rendered pages and ordinary HTML go through the same conversion engine. Follows robots.txt per RFC 9309. $0.005 USDC on Base via the Coinbase CDP facilitator. Example:
GET /v1/md?url=https://example.comorPOST /v1/md {"url":"https://example.com"}. The origin is paid only after the caller's own payment has settled. (OpenAPI) (MCP server) (llms.txt) - x402 Crypto Research API — Generates current, source-linked cryptocurrency ecosystem research reports for 0.01 USDC per POST request on Base mainnet. Example:
{"topic":"Give a concise current status update on the Base ecosystem."}. (GitHub) - 402cron — Schedules signed HTTP deliveries to a registered endpoint on a cron schedule, paid per delivery in USDC on Base via x402, no account or card required.
- gravee — 23 pay-per-call business lead generation and market intelligence endpoints: scored leads by vertical and location, business scoring, contact extraction, competitor analysis, multi-source verification, digital health audits, WHOIS, social presence, tech stack detection, formation data, hiring signals, review aggregation, market saturation, gap analysis, growth trajectory, website status, email and phone verification, competitive pricing. $0.005–$0.75 USDC per call on Base and Solana. No API keys — wallet is auth. (Manifest) (llms.txt)
- AgentPay Summarize — Summarizes up to 20,000 characters of text into a 250-word summary returned as JSON.
POSTonly, $0.01 USDC on Base mainnet. Example:POST /v1/summarize {"text":"..."}. (Manifest) (MCP) (OpenAPI) - AgentPay Token Safety — Reports rug-pull and honeypot risk signals and liquidity for a token contract address.
POSTonly, $0.02 USDC on Base mainnet. Example:POST /v1/token-safety {"address":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"}. (Manifest) (MCP) (OpenAPI) - AgentPay Insurance Lead Analysis — Classifies an inbound insurance lead, extracts structured fields from it, and returns a lead summary in one call.
POSTonly, $0.10 USDC on Base mainnet. Example:POST /v1/insurance-analysis {"text":"..."}. (Manifest) (MCP) (OpenAPI) - Basalt — 20 pay-per-call utility tools for AI agents: URL metadata extraction, domain availability via RDAP, email/MX validation, HTML-to-Markdown and Markdown-to-HTML, QR code generation, PDF text extraction, TLS certificate checks, language detection (186 languages), JSON Schema validation, EIP-191/EIP-712 signature recovery, IBAN/BIC/card-number checksums, geo distance, time-zone conversion, LLM token counting, hashing and HMAC, JWT decoding, URL parsing and canonicalization, EVM address checksum, and IP classification with CIDR checks. $0.002-$0.01 USDC on Base. Example:
POST /domain-check {"domain":"example.com"}. (OpenAPI) - D-007 Document Classify and Rename Plan — Generates a dry-run classification, traversal-safe filename, folder proposal, and duplicate signals for one supplied document record. $0.01 USDC on Base mainnet via x402. Example: POST /v1/x402/document-classify-rename-plan {"originalFilename":"invoice-2026-09.txt","extension":".txt","size":1024,"textExcerpt":"Invoice for order","metadata":{}}.
- DreamWidget — Website widgets (logo showcases, a YouTube/Vimeo/Twitch/TikTok video wall) for an agent's client: POST /api/v1/plan answers 402 for a plan term in USDC on Base, USDC on Solana, XRP, or HBAR and USDC on Hedera; the paid retry grants the plan and returns the account and API key. OpenAPI at /openapi.json.
- 4yearcycle data catalog — Twelve pay-per-call data endpoints for agents covering EU tenders (TED) and grants (CORDIS), crypto derivatives, DeFi yields, ERC-20 token safety, gas, ECB FX rates, German weather (DWD), live flights, news headlines, Bitcoin on-chain state and web search, $0.005–$0.02 USDC on Base mainnet via the Coinbase CDP facilitator with no API key or account. Example:
GET https://4yearcycle.com/x402/fx-rates?base=USD&symbols=EUR,GBP,JPY. (OpenAPI) (Manifest) (Site) - X402 Git — Sells paid access to private git repositories (agent skills, harnesses, libraries) over x402 v2, USDC on Base, settled through the CDP facilitator; the manifest (file tree, languages, licence, security scan, release log) is public before payment and the code is private until settlement, every listing is its own 402 endpoint declaring the
bazaarextension, and creators publish headlessly through an API with a buy-side MCP server for agents. (Discovery, OpenAPI) - MadeOnSol — Solana KOL trade feeds, deployer reputation, token risk/buyer-quality scoring, and wallet PnL for AI agents, $0.005-$0.02 USDC on Solana with self-verified settlement (no facilitator); manifest lists all 25 endpoints. Example:
GET /api/x402/token/{mint}.
New to x402? Three steps to your first payment.
1. Pick a facilitator
| Use case | Facilitator |
|---|---|
| Most chains, full SDK support | Coinbase CDP |
| Edge deployment, global latency | Cloudflare x402 |
| Enterprise billing + disputes | Stripe Machine Payments |
2. Install the SDK
# TypeScript
npm install x402-express # or the core package: @coinbase/x402
# Python
pip install x402# Rust
cargo add x402-axum x402-reqwest # x402-rs — see SDKs & Libraries shelfChecked 2026-09-20. A crate literally named x402 exists on crates.io but is a placeholder
with no working code — use x402-rs's crates (x402-axum for servers, x402-reqwest for
clients) instead.
3. Add payment middleware
import { paymentMiddleware } from '@coinbase/x402-express';
app.use(paymentMiddleware(wallet, {
'/api/data': { price: '$0.01', network: 'base-mainnet' }
}));That's it. The middleware returns 402 with payment details, verifies the client's payment header, and lets the request through.
Full quickstart → · Testnet setup →
1. Client → GET /api/data (initial request)
2. Server ← 402 Payment Required (payment details in header)
payment-required: <base64 challenge> (v2; v1 used X-Payment-Required
and put the detail in the body)
3. Client → EIP-3009 gasless USDC transfer (client signs + submits)
4. Client → GET /api/data + X-Payment: {signed tx} (retry with payment)
5. Facilitator → verify + settle on-chain (~2 seconds)
6. Server ← 200 OK + X-Payment-Response (resource returned)
No gas for the sender. No subscription. No API key. Payment IS authentication.
This README is the front door. The full curated directory — every shelf, every entry — is in directory/.
Other lists worth knowing: the community awesome-x402 accepts everything and is the right place for exhaustive coverage. Glama indexes MCP servers at enormous scale and publishes its own health data, which is rarer than it should be. Different jobs. Use all three.
gold-402 is curated, not exhaustive. Every entry earns its place.
See CONTRIBUTING.md for the curation standard, badge system, acceptance criteria, and submission process.
Quick rules:
- Entry must use the x402 protocol (HTTP 402 + X-Payment), not just USDC or general crypto payments.
- Live URL or public GitHub repo. Link must work.
- Last activity within 12 months (for libraries and resources without a live endpoint).
- One entry per pull request. Format:
[Name](url) — Description starting uppercase, ending with period. - Descriptions are factual. No marketing language.
Curated by 24K Labs
If this saved you time, star the repo.
24klabs.ai •
x402.org •
Protocol Spec •
Coinbase Docs •
Discord •
Live Dashboard